A court in the United Kingdom has sentenced a member of the online cybercrime collective known as The Com to two years in prison, closing an investigation the National Crime Agency opened in January 2024. Justin Swaddle, who used the handles Epstein, Rugen and Moscow across Discord, Snapchat and Telegram, pleaded guilty to multiple counts of blackmail and child abuse. The court placed him on the National Sex Offenders Register and imposed a ten year Sexual Harm Prevention Order.
Prosecutors identified 117 victims, all girls between 13 and 17, spread across the world.
The case is being written up in security feeds rather than only crime pages for a specific reason, and it is worth being precise about what that reason is. The Com is not a gang with a payroll. Investigators describe it as a loose, decentralized network that splits into factions with different specialisms: physical violence for hire, sexual coercion, financial extortion, and high profile corporate ransomware. The same talent pool that produced this case also supplies people to intrusions that end with an enterprise negotiating a ransom. Details of the sentencing were published in SentinelOne's weekly security roundup.
Status was the payment
What the NCA found does not fit the usual model of online crime, because there was no money in it. Swaddle systematically approached and groomed young and vulnerable targets on mainstream chat platforms, then coerced them into self harm and into producing explicit material. Investigators say he was motivated by the standing and notoriety he earned by sharing that material inside closed subgroups, not by profit.
The leverage was ordinary personal data. When victims refused to comply, he used recordings he already held, along with their home addresses and school details, to force them to continue. That is the same coercion pattern that turns up in corporate cases, where an attacker who already has one piece of a person's life uses it to extract the next one.
Six countries to find 117 children
The investigation started after West Yorkshire Police arrested Swaddle in January 2024 and the NCA took it on. Because the victims were scattered internationally, British officers had to work with law enforcement in the United States, Australia, Canada, Norway and New Zealand to identify and safeguard the children involved. Our United Kingdom country profile tracks the NCA's caseload alongside the rest of the national picture.
Why an intrusion team should read the file
Corporate security teams tend to model The Com through its most familiar output, which is the English speaking social engineering crew that talks its way past a help desk. Cases like this one are a reminder that the network's core skill is not technical at all. It is pressure applied to a specific person who has something the attacker wants, whether that is an explicit image or a password reset. We have seen the commercial version of the same instinct in extortion crews that run vishing campaigns behind rotating brand names.
Two years is a short sentence for 117 victims, and the arithmetic of that will be argued elsewhere. The operational point for defenders is narrower: the people who show up in these prosecutions are drawn from the same rooms as the people who show up in ransomware incident reports, and they are practiced at manipulating a human long before they touch a system.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.